19bf50819ee2e3b3f6c86c4a64889889c05a1e135348136cfafeba7e03cc0e3b

Analysis

max time kernel
148s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
24/12/2023, 16:53

Target

06bce9faeca418674412ad10d336eeb1.dll
Size

37KB
MD5

06bce9faeca418674412ad10d336eeb1
SHA1

f5bd17327def75a971f518a15dbf72f1d919a343
SHA256

19bf50819ee2e3b3f6c86c4a64889889c05a1e135348136cfafeba7e03cc0e3b
SHA512

74bf2f1ac1aa2c115f0b9b0b18cd7bdfbc07dfceef72f6f9856e30620a28f44aa47491c4b45838bafc7e262be299e8175ad898c5e9700e3bb8add3a8ce2269f5
SSDEEP

768:R2k79wslGXkQqlX1ujD+3bKQg9vzTbnR4aK4Bd90JnWFl1:59wslGXkXXqDmKQWTbneaH70ZWFl1

Score

1^/10

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4844	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1712 wrote to memory of 4844	1712	rundll32.exe	19
PID 1712 wrote to memory of 4844	1712	rundll32.exe	19
PID 1712 wrote to memory of 4844	1712	rundll32.exe	19

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\06bce9faeca418674412ad10d336eeb1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1712
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\06bce9faeca418674412ad10d336eeb1.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:4844